Re: [PATCH 1/2] gfs2: release the statfs glock when gfs2_clear_beyond_eof() fails

[Joseph Qi <joseph.qi@linux.alibaba.com>]

Ping...

On 11/5/26 1:46 PM, Joseph Qi wrote:
> gfs2_file_buffered_write() acquires the master statfs glock before
> writing to the rindex and releases it once the write is done.  The only
> error path in between used to be the failure of that acquisition, which
> gfs2_glock_nq_init() unwinds by itself, so the cleanup code at the end of
> the function never had to deal with a held statfs glock.
> 
> Commit 4982e58669b1 ("gfs2: page poisoning fix") added a call to
> gfs2_clear_beyond_eof() right after the acquisition and made it jump to
> out_unlock on failure.  That path only drops the inode glock and then
> frees statfs_gh, so a failed write to the rindex leaves the master
> statfs glock held exclusively and frees a holder that is still linked
> into the glock's holder list.  The GL_NOCACHE demote is requested by
> __gfs2_glock_dq(), which is never reached, so the glock stays locked for
> the rest of the mount, and the glock and pid references taken by
> __gfs2_holder_init() leak as well.  Walking the stale list entry later
> on, for instance from do_promote() or from a demote callback, is a
> use-after-free.
> 
> gfs2_clear_beyond_eof() zeroes the space beyond eof, which for the
> rindex ends up in adjust_fs_space(), so the call cannot be moved out
> from under the statfs glock.  Release the holder in the error path
> instead, guarded by gfs2_holder_initialized() so that the paths which
> never acquired it and the one which already released it are unaffected.
> 
> Fixes: 4982e58669b1 ("gfs2: page poisoning fix")
> Cc: stable@vger.kernel.org
> Signed-off-by: Joseph Qi <joseph.qi@linux.alibaba.com>
> ---
>  fs/gfs2/file.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c
> index 1efd0679badd9..2452d3ecf09c7 100644
> --- a/fs/gfs2/file.c
> +++ b/fs/gfs2/file.c
> @@ -1087,6 +1087,8 @@ static ssize_t gfs2_file_buffered_write(struct kiocb *iocb,
>  		goto retry;
>  	}
>  out_unlock:
> +	if (inode == sdp->sd_rindex && gfs2_holder_initialized(statfs_gh))
> +		gfs2_glock_dq_uninit(statfs_gh);
>  	if (gfs2_holder_queued(gh))
>  		gfs2_glock_dq(gh);
>  out_uninit: